diff options
| -rw-r--r-- | dot_config/waybar/config.jsonc | 9 | ||||
| -rw-r--r-- | dot_config/waybar/executable_snx-vpn-status.sh | 20 | ||||
| -rw-r--r-- | dot_config/waybar/executable_snx-vpn-toggle.sh | 19 | ||||
| -rwxr-xr-x | etc/systemd/system-sleep/50-snx-rs | 32 | ||||
| -rwxr-xr-x | run_onchange_after_deploy-etc.sh.tmpl | 2 |
5 files changed, 2 insertions, 80 deletions
diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc index 4d38f64..89a8ea9 100644 --- a/dot_config/waybar/config.jsonc +++ b/dot_config/waybar/config.jsonc @@ -10,7 +10,6 @@ "temperature", "custom/memory", "custom/vpn", - "custom/snx-vpn", "network#bond", "custom/dock", "battery", @@ -121,14 +120,6 @@ "on-click": "~/.config/waybar/vpn-toggle.sh", }, - "custom/snx-vpn": { - "exec": "~/.config/waybar/snx-vpn-status.sh", - "return-type": "json", - "interval": 5, - "signal": 9, - "on-click": "~/.config/waybar/snx-vpn-toggle.sh", - }, - "battery": { "format": "{icon} {capacity}%", "format-charging": " {capacity}%", diff --git a/dot_config/waybar/executable_snx-vpn-status.sh b/dot_config/waybar/executable_snx-vpn-status.sh deleted file mode 100644 index f88c3a0..0000000 --- a/dot_config/waybar/executable_snx-vpn-status.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/env dash -# Waybar custom/snx-vpn module: report the snx-rs (Check Point) tunnel -# state. `snxctl status` is fast (talks over a local UDS to the daemon) -# but might briefly stall during connect; cap it with `timeout`. - -# Bail out if the daemon socket isn't even there (snx-rs.service stopped). -out=$(timeout 2 snxctl status 2>/dev/null) || out= - -case "$out" in - '' | *"Disconnected"*) - printf '{"text":"<span color=\\"#928374\\"><s> SNX</s></span>","class":"down","tooltip":"snx-rs disconnected — click to connect"}\n' - ;; - *"Connecting"* | *"MFA pending"*) - printf '{"text":"<span color=\\"#fabd2f\\"> SNX…</span>","class":"connecting","tooltip":"%s"}\n' "$(echo "$out" | head -1)" - ;; - *) - tooltip=$(echo "$out" | sed 's/"/\\"/g' | awk 'BEGIN{ORS="\\n"}{print}') - printf '{"text":"<span color=\\"#b8bb26\\"> SNX</span>","class":"up","tooltip":"%s"}\n' "$tooltip" - ;; -esac diff --git a/dot_config/waybar/executable_snx-vpn-toggle.sh b/dot_config/waybar/executable_snx-vpn-toggle.sh deleted file mode 100644 index 80ced4c..0000000 --- a/dot_config/waybar/executable_snx-vpn-toggle.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env dash -# Toggle the snx-rs (Check Point) tunnel. -# -# Refresh the waybar custom/snx-vpn module immediately with SIGRTMIN+9. -set -eu - -state=$(timeout 2 snxctl status 2>/dev/null || echo Disconnected) - -case "$state" in - *"Disconnected"*) - setsid -f snxctl connect >/tmp/snxctl.log 2>&1 & - ;; - *) - snxctl disconnect >/dev/null 2>&1 || true - ;; -esac - -pid=$(pidof waybar || true) -if [ -n "$pid" ]; then kill -SIGRTMIN+9 "$pid" 2>/dev/null || true; fi diff --git a/etc/systemd/system-sleep/50-snx-rs b/etc/systemd/system-sleep/50-snx-rs deleted file mode 100755 index 3738f72..0000000 --- a/etc/systemd/system-sleep/50-snx-rs +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/sh -# Bounce the system-scope snx-rs (Check Point) tunnel around suspend/hibernate. -# -# Problem: during suspend the IKE SA keepalive is interrupted and the SAML -# session cookie may expire. snx-rs doesn't detect this — the daemon -# happily sits on dead sockets after resume, so `snxctl status` reports -# "Connected" while no traffic actually goes through. The user has to -# manually disconnect+reconnect (which re-triggers the SAML browser flow). -# -# Fix: stop the daemon before suspend, start it after resume. The tunnel -# is left disconnected on resume — user clicks the waybar toggle (or any -# `snxctl connect`) to re-establish, which goes through SAML if and only -# if the cached cookie has actually expired. Net result: -# - waybar correctly shows "disconnected" immediately on resume -# - one click reconnects (often without re-doing SAML) -# - no stale "Connected"-but-dead state -# -# Invoked by systemd-suspend(8) / -hibernate / -hybrid-sleep with -# $1 = pre|post $2 = suspend|hibernate|hybrid-sleep|suspend-then-hibernate -set -eu - -case "$1" in - pre) action=stop ;; - post) action=start ;; - *) exit 0 ;; -esac - -# The command-mode daemon runs as a system service because it configures -# routes, DNS, and tunnel interfaces. Ignore missing/disabled states so this -# hook remains harmless on non-work profiles. -systemctl is-enabled snx-rs.service >/dev/null 2>&1 || exit 0 -systemctl "$action" snx-rs.service || true diff --git a/run_onchange_after_deploy-etc.sh.tmpl b/run_onchange_after_deploy-etc.sh.tmpl index 45e5c26..742ef82 100755 --- a/run_onchange_after_deploy-etc.sh.tmpl +++ b/run_onchange_after_deploy-etc.sh.tmpl @@ -38,6 +38,8 @@ fi # sudo-rs: /etc/pam.d/sudo-i is a symlink to /etc/pam.d/sudo sudo ln -sfT sudo /etc/pam.d/sudo-i +sudo rm -f /etc/systemd/system-sleep/50-snx-rs + # Clean up sleep-target masks from the earlier hardened-suspend # workaround. Now that mem_sleep_default=s2idle resolves the wake hang, # suspend is enabled again. Remove any leftover /dev/null symlinks. |